Apache Thrift EUVD-2026-91586

Exploitation requires a service that uses the Apache Thrift PHP bindings (versions before 0.25.0) and accepts attacker-reachable Thrift protocol input, typically an exposed RPC/serialization endpoint that deserializes untrusted messages. Per the CVSS vector there is no authentication (PR:N) or user interaction (UI:N) requirement and the vector is network-based, so the main limiting factors are whether a Thrift PHP service is actually network-exposed to the attacker and whether it parses attacker-controlled serialized data; impact is bounded to availability (service crash/DoS), not data disclosure or code execution per the vendor scoring.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, which normally indicates high real-world risk. However, the impact metrics are confined to availability only (VC:N/VI:N/VA:H), meaning this is scored as a denial-of-service rather than code execution. This is notable because the CWE (CWE-121 stack-based buffer overflow) plus the mention of integer overflow would often enable memory corruption and potential RCE; the vendor's choice of VI:N/VC:N suggests they assess the practical outcome as a crash/availability loss, not arbitrary code execution - this discrepancy should be verified with Apache. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation: status is no public exploit identified at time of analysis. Net assessment: a genuine but currently DoS-bounded, unauthenticated-network issue - treat as a priority to patch for internet-exposed or multi-tenant Thrift PHP services, but it is not a confirmed RCE and shows no exploitation-in-the-wild signals at this time.

A remote, unauthenticated attacker sends a crafted Thrift protocol message to a service built on the Apache Thrift PHP bindings, triggering the integer overflow/stack-based buffer overflow in the message/field parsing path. The malformed length or size value causes memory corruption that crashes the PHP worker or service, producing a denial of service against the RPC endpoint. No public exploit code is known at the time of analysis.